Skip to content

Taking back control of old.reddit.com

4 min read
Breaking freeForking Redlib to add some tasteDNS interception and hijacking reddit.comLimitations and security

In June, Reddit put old.reddit.com behind a login. It already blocked Mullvad, the VPN I use, so I was locked out entirely and lost any motivation to go back. Fast forward to today and things are as good as they used to be: reddit.com on my home network loads the old interface from my homelab. No account needed, no bullshit QR code popups, no delayed sign-in blocks, no terrible redesigned UX.

Reddit has been ruining its product for years. It has become a textbook example of enshittificationen·shit·ti·fi·ca·tion/ɛnˌʃɪtɪfɪˈkeɪʃən/noun1.The gradual degradation of an online platform as it prioritizes profit over its users.Coined by Cory Doctorow, 2022.. Others agree:

Until June, old.reddit.com gave long-standing users a way to keep the old interface. With that gone, I wanted a fix that did not depend on Reddit's whims.

Goal: route every reddit.com request to a private instance that keeps the old theme, works behind a VPN, needs no login, and is open source and extensible.

Breaking free

I started with Redlib, a private Reddit frontend that retrieves public content through anonymous OAuth and renders it without Reddit's login wall, ads, or client-side tracking. Major shoutout to the Redlib team <3. I hosted it locally at https://redlib.homelab.internal, making it available to every device on my LAN.

Two problems remained:

  1. Redlib's interface differed from the old Reddit UX I preferred.
  2. Links to Reddit still opened the broken official site, and rewriting every URL by hand was not sustainable.

Forking Redlib to add some taste

I wanted Redlib with the old Reddit UI/UX I already knew, so I forked it and added:

  • An old.reddit.com-inspired theme
  • Responsive mobile support
  • Light and dark modes
  • Minimal JavaScript
  • Favorites, subscriptions, search, grid view, a media viewer, branding options, and simpler local development

I'm calling the fork Threadshift, but the Redlib team deserves the credit for the heavy lifting. At this point, https://redlib.homelab.internal served this lovely masterpiece:

Threadshift runs with Docker Compose or directly from source, all through the Makefile:

make setup    # once
make local    # run from source
make docker   # or run with Docker Compose

make setup copies redlib.example.toml to redlib.toml for instance settings. Every upstream REDLIB_* option in .env.example still works, and each extension gets its own section:

[ext.classic]
brand = "Threadshift"   # logo text, page titles, footer
logo = ""               # URL or data: URI; "" = built-in, "none" = hide

[ext.favorites]
favorites = true

[ext.search]
suggest = false

[ext.media]
grid = false
gridFull = false
filter = "all"          # all, media, images, videos
expand = false
viewer = true
hoverPlay = true
autoplay = false
infinite = false

[ext.vault]
label = "programming"

Any key can also be set as an environment variable, such as REDLIB_EXT_MEDIA_GRID_FULL=on. The full set of keys lives in the config schema.

One problem remained: typing or clicking reddit.com still opened the real site instead of my instance.

DNS interception and hijacking reddit.com

My homelab is a single node on its own subnet. A Traefik reverse proxy handles TLS termination and routing for my self-hosted applications. My router runs OpenWrt, which gives me control over DNS, firewall rules, and routing.

The basic request flow looks like this:

Browser → OpenWrt DNS → Traefik → Threadshift → Reddit API

Initially, this flow only handled my custom redlib.homelab.internal hostname. Links to Reddit still bypassed it.

Serving Threadshift at reddit.com requires four pieces:

  • An exact DNS override for reddit.com
  • DNS interception for selected clients
  • A locally trusted TLS certificate for reddit.com
  • A Traefik route from reddit.com to Threadshift

With those in place, a request flows like this:

Browser asks OpenWrt DNS for reddit.com and gets Traefik's IP, connects over HTTPS with a locally trusted certificate, and Traefik proxies to Threadshift, which fetches public Reddit data and returns the page.BrowserOpenWrt DNSTraefikThreadshiftReddit APIreddit.com?192.168.30.10HTTPS reddit.comtrusted certproxy :8080fetch public dataJSONrendered page
Solid arrows are requests; dashed arrows are responses.

The certificate is the piece you can't skip. Without one the browser trusts, you'll see some flavour of these errors:

  • Brave/Chrome: NET::ERR_CERT_AUTHORITY_INVALID
  • Wrong hostname: NET::ERR_CERT_COMMON_NAME_INVALID
  • curl: SSL certificate problem: unable to get local issuer certificate
  • Reddit HSTS: the browser may not offer a Continue anyway option.

Limitations and security

  1. Only the apex reddit.com domain is overridden. Subdomains such as www.reddit.com and oauth.reddit.com remain public, so OAuth and deliberate links to the real site still work. The trade-off: search engines mostly link to www.reddit.com, so those clicks still reach the real site.
  2. Because the browser believes it is visiting reddit.com, it may send existing Reddit cookies to Traefik and Threadshift. I use a dedicated browser profile that has never logged into Reddit.
  3. Every client must trust the private CA, and its private key must stay protected.
  4. Application-level DNS-over-HTTPS, certificate-pinned apps, and devices outside the configured LAN can bypass or reject this setup. Tailscale and WireGuard clients need separate DNS and routing configuration.